Malware
GRAYRABBIT
- First Reported
- Sep 10, 2026
- Latest Reported
- Oct 13, 2026
Reported Context (2)
- September reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin Recorded Future Reports 94 High-Impact Vulnerabilities in September 2026, Including 80 Actively Exploited
- We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link. Sogou Input Method Flaw Let UNC3569 Deliver GRAYRABBIT Backdoor with a Single Click
CVE (77)
Malware (6)
Threat Actors (8)
MITRE ATT&CK (15)
Vendors (12)
Products (69)
Tools (7)
Industries (5)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.